RSSO without Radius Framed-IP-Address attribute

[ericll75]

Is it possible to establish an RSSO session on a Fortigate without knowing the Caller's IP address?  Ideally, to either use the Calling-Station-Id attribute to track the session, or else have the Fortigate fill in the session's IP address on its own rather than requiring a Framed-IP-Address attribute to be sent in the Accounting-Start request?

I am trying to use a fairly straight setup, with port one on the Fortigate requiring 802.1x and sending requests to a FreeRADIUS server on port 2.  The Fortigate is acting as a DHCP server on port one, but I also have computers with static IP's on that same port.  The authentication itself works fine, but the problem is that the Radius server does not know the caller's IP address and therefore cannot fill in the Framed-IP-Address in the Accounting Start packet.  It seems that the Fortigate always drops any Accounting Start or Interim packet that does not contain this attribute. I thought about putting a DHCP server on the FreeRADIUS server, and then sending an Accounting Start packet only after the server hands out an IP (having the Fortigate act as a DHCP relay), but this would not work in the case of computers using static IP's (defined locally, not through static DHCP entries), since neither the DHCP server nor the Radius server would know the Caller's IP address.  I would rather not have to maintain a list of MAC addresses vs. IP's on the server.  Also, I noticed that if the Fortigate is set to send accounting records to Radius, those accounting records still do not contain the caller's IP (and are not sent anyhow unless the Fortigate has already received an Accounting-Start). Is any of the following possible? 1 - Use the Calling-Station-Id attribute to track the user's session instead of Framed-IP-Address?  Or at least configure the Fortigate to accept Accounting packets that do not contain a Framed-IP-Address?

2 - Have the Fortigate fill in the IP address for the user's session itself?  The devices, with their actual IP addresses, MAC addresses, and username show up just fine in the Device Inventory when I have Device Detection turned on, so the unit obviously already has all of this information!

3 - Allow the FreeRADIUS server to poll the Fortigate's ARP table in order to resolve the MAC address and then send the Accounting-Start packet at that point?

I am running a Fortigate 90D with FortiOS 5.4.3.

Thank you,

Eric